PT-2019-14885 · Fusionpbx · Fusionpbx

Pierre Jourdan · Published 2019-10-21 · Updated 2023-02-04 · CVE-2019-16965

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FusionPBX versions up to 4.5.7

Description The issue is related to a command injection vulnerability due to a lack of input validation in the resources/cmd.php file. This allows authenticated administrative attackers to execute any commands on the host as www-data.

Recommendations For FusionPBX versions up to 4.5.7, update to a version that includes input validation for the resources/cmd.php file to prevent command injection attacks. As a temporary workaround, consider restricting access to the resources/cmd.php file to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-16965

Affected Products

Fusionpbx

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-16965 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16965 · Vendor Advisory
• https://github.com/fusionpbx/fusionpbx/commit/6baad9af1bc55c80b793af3bd1ac35b39c20b173 · Note
• https://t.me/cvenotify/43610 · Telegram Post
• https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-sofia-api-command-injection-2 · Note